10

I recently setup a virtualization server for the small company I'm running. This server runs few virtual machines that are used for development, testing, etc...

My business partner works from a remote location, thus I also installed a vpn server on the virtualization host to make it possible for him to safely reach the company services. Moreover, again on the virtualization host, I installed bacula to perform the backup of the data.

Is it advisable/good practice to do so or should I create one more virtual machine to do backups and VPN? Is it a bad idea to run these services on the host itself? If yes, why?

Improve this question

2 Answers 2

Reset to default
9

The virtualizaton host should be the most secure machine you have. The most secure machine is one that is not connected to a network at all ;-)

Having that in mind it is best not to offer any services on your public interfaces. You should not even have an IP there (a bridge for VMs is layer2).

Think of the VM-host as DMZ: traffic into it is forbidden, originating no problem.

So in your example:

  • VNC: Bad - this is an incoming service
  • Backup: No problem - sessions are initiated from here to the outside

But even then - you should only run services that will not eat up RAM/CPU/IO on your VM-host - else your VMs will suffer from lack of resources.

Improve this answer
1
  • I must say that I share your view, now that you point out these facts. Putting VPN and backup services on a separate VM will also ease future migration (if that will ever be required). I will configure only one NIC for access in the internal network, as the server is not easily reachable. The other NICS will be put in bridged mode. Thanks!
    – Giordano
    Oct 13, 2012 at 20:44
5

I'd suggest separating the VPN functions to a hardware-based firewall or separate device... E.g. what happens if the server is down?

But in lieu of that, it is possible to use your existing virtualization host as the terminus for your VPN. Backups aren't necessarily a problem either.

This sounds like a small setup (what type of hardware are you using?), but if you're asking, maybe you have some reservations? Why do you think it may not be a good idea?

Improve this answer
3
  • I have a quite powerful Dell PowerEdge T410, with 2 processors and 32GB of RAM. My concerns are more on the security side, since I know that it takes little to break into a system that is not well configured ^^ I never got a clear answer on this topic thus I decided to ask.
    – Giordano
    Oct 13, 2012 at 20:38
  • 3
    @Giordano The point that he's making is that if that server reboots for some reason (hardware issue, power issue) and doesn't come back up cleanly, it will be impossible to troubleshoot remotely. If your VPN is on a device like your firewall, you'll be able to connect to the DRAC and maybe get it running.
    – MDMarra
    Oct 13, 2012 at 20:43
  • Very much true, another very good point. Currently I have no big troubles accessing the server (it is in the same building) however buying a device for VPN is definitely a good move. Thanks for pointing this out.
    – Giordano
    Oct 13, 2012 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .